Licensing Vulkro for Salesforce
No account is needed to scan. Install vulkro-sf and point it at a
project: Apex, Lightning Web Components, Aura, Visualforce, Flow and
metadata, every finding with its proof and its fix, and where the package
stands against the Security Review, on screen. That is Free. It is
permanent, and it never asks you to sign in.
An account holds Pro. Pro is the set of capabilities that read the live
org, gate the submission and write the report you hand to someone else.
The first verified device login with vulkro-sf login starts a 14-day
term of the full product; after that, licences are issued directly by our
team at license@vulkro.com. There is no
self-serve checkout.
Scanning always runs locally: your code, metadata, and customer records never leave the machine. The only thing the account layer moves over the network is a short device token and anonymous usage counters.
Vulkro for Salesforce is licensed on its own. A vulkro-sf seat or key is
a different product from a core vulkro seat or key, and neither one
substitutes for the other. Both together on one seat are priced on the
pricing page.
What is Free and what is Pro
The list below is the Salesforce half of the registry compiled into the
scanner; vulkro-sf license-status prints the same words, and the
pricing page shows both products.
Free
| Capability | What it is |
|---|---|
| Salesforce scan | Apex, LWC, Aura, Visualforce, Flow and metadata on one project |
| Readiness checklist | Where the package stands against the Security Review, on screen |
| Attack surface | What is externally reachable, and what a guest user can hit |
| Project reference | Docs, consistency checks, the rule playbook and package CVEs |
Pro
| Capability | What it is |
|---|---|
| Live-org audit | Permissions, session, MFA, sharing, packages and trust, read from the org itself |
| Guest exposure | What an unauthenticated visitor reaches in the org |
| Presubmit gate | Fail the build before the package is submitted |
| AppExchange report | The readiness report you hand to the Security Review team |
| Salesforce compliance | The evidence pack, rendered and bundled |
| Blast radius | What a change touches, before it ships |
| Org maps | Flows, roles and where the PII lives, as maps |
| Anti-patterns | The Well-Architected review, run over the project |
| Salesforce trends | How the org posture moved, with event monitoring |
| Org-scale operations | Recertification, limits, coverage risk and masking rules |
| Salesforce portfolio | Every client org at once, rolled up |
| Secrets in git history | Credentials that were committed to this project and then removed |
| PMD wrapper | Merge a local PMD-for-Apex run into the report |
| ESLint wrapper | Merge a local ESLint run over LWC and Aura into the report |
| RetireJS wrapper | Flag vulnerable JavaScript vendored into static resources |
Two lines worth reading twice. The readiness checklist is Free: you
see every section and where the package stands. The readiness report
you hand to the Security Review team is Pro. And every live-org command
(vulkro-sf org ...) is Pro: connecting a production org is a company
act, so it sits with the licensed seat.
A Pro command run on Free stops before it does any work, prints what it
needs and where to get it, and exits 1. Exit 2 stays reserved for
real errors. Each Pro view in the console opens three times on Free
before it locks, so you can see what it adds on your own project.
Sign in: vulkro-sf login
Log in and pair this device with your Vulkro account, then install the returned lease. Three ways in, tried in this order:
vulkro-sf login # browser login (default): shows a code, opens your browser
vulkro-sf login --code ABCD-1234 # paste a pairing code from app.vulkro.com/connect
VULKRO_ACCOUNT_TOKEN=... vulkro-sf login # CI / headless: exchange a stored device token
- Browser login (
vulkro-sf login, no arguments) prints a short code (for exampleABCD-1234), opens your default browser to the account console, and waits while you approve that code in a logged-in tab. If a browser cannot be opened, it prints the URL to open by hand. Approval assigns a seat and installs the lease. - Pairing code (
vulkro-sf login --code <CODE>) pastes a code from app.vulkro.com/connect instead. Use it on headless machines or when no browser is available. - CI / headless: set
VULKRO_ACCOUNT_TOKENto a stored device token and runvulkro-sf loginwith no--code. It exchanges the token for a lease with no browser and no code.
The lease refreshes automatically on the daily entitlement ping while online and stays valid fully offline through its signed expiry (about 14 days). The ping carries only anonymous usage counters plus this device's token: never your code, findings, or machine fingerprint.
Exit codes: 0 logged in and lease installed; 2 error (offline set,
account-server failure, an invalid lease, or a denied / expired /
timed-out browser login).
The 14-day term, and after it
The first verified device login on an account starts a 14-day term of the full product: every live-org command, the AppExchange report and the presubmit gate from day one. The term is issued by the server; nothing starts until a device has signed in and been verified.
When the term lapses the machine drops to Free and keeps scanning; live-org
scans stop until a seat is issued. Request one from the Vulkro team at
license@vulkro.com. vulkro-sf buy opens a
pre-filled request email with this machine's fingerprint. The team issues
a seat on your account, or a .lic file for a machine that cannot reach
the network.
vulkro-sf account
Show your Vulkro account: email, tier, seat (for example "seat 2 of 5"), expiry, offline-grace remaining, and last sync. 100% local: makes no network call and works air-gapped.
vulkro-sf account
Exit codes: 0 report printed; 2 local database read error.
vulkro-sf license-status
Prints the current Vulkro for Salesforce licence state on this machine:
sign-in status, expiry, machine ID, and the Pro checklist generated from
the registry compiled into the scanner. --format markdown and
--format json emit the whole matrix. It needs no account to run.
vulkro-sf license-status
vulkro-sf license-status --format json
Exit codes: 0 on success, 2 on error.
vulkro-sf logout
Log out this device: delete the local device token and cached lease,
then make a best-effort revoke call to the account server. Local logout
always succeeds; a failed or offline revoke is a warning, not an error.
A perpetual offline .lic you installed with vulkro-sf activate is
left untouched and keeps working. After logout the machine is on Free.
vulkro-sf logout
Exit codes: 0 logged out (or nothing to do); 2 local database error.
Air-gapped: vulkro-sf machine-id, buy, and activate
Machines that cannot reach the public internet hold Pro through a
licence file instead of vulkro-sf login. Existing .lic customers
(including AppExchange and VKSF keys) stay on this path with no change.
Free needs no file at all.
vulkro-sf machine-id
Prints this machine's Vulkro fingerprint (32 hex characters). It is the
same value the desktop console shows under Settings, License, "This
machine's ID". Paste it into your licence request so the .lic file the
team mints is bound to this machine.
vulkro-sf machine-id
Exit codes: 0 on success, 2 on error.
vulkro-sf buy
Opens a pre-filled licence-request email with this machine's ID, or prints the address when running headless. You can also request a licence directly from license@vulkro.com. Prices are on the pricing page.
vulkro-sf buy
Exit codes: 0 on success, 2 on error.
vulkro-sf activate
Installs a .lic activation key. It verifies the Ed25519 signature and
the machine binding, then stores the key locally, with no remote server
in the loop. A vulkro-sf key is a separate product from a core
vulkro key, so a core key does not unlock the Salesforce scanner and
vice versa.
vulkro-sf activate ./vulkro-sf.lic
On an air-gapped machine, copy the .lic file across and run
vulkro-sf activate <file.lic> there. Set VULKRO_SF_OFFLINE=1 to turn
login, the lease refresh, and any other optional outbound call into a
hard error; it does not affect the local activation flow, and
vulkro-sf account still works.
Exit codes: 0 on success, 2 on error.
CI runners
A runner scans on Free with no sign-in at all. The presubmit gate and the
AppExchange report are Pro, so a runner that gates a build needs a seat:
for a networked runner, set VULKRO_ACCOUNT_TOKEN to a stored device
token and run vulkro-sf login as the first step. For an air-gapped
runner, request a key for the runner image's fingerprint, bake the .lic
file into the image (or inject it as a secret at job start), and run
vulkro-sf activate <file.lic> before the first gated step. See
CI/CD integration.